This exercise (50 points) uses the AWS Cloud9 environment develop and fully test a set of tools and Web Forms to perform the following functionality: 

a. Password Login form – This Python form allows a user to login to a simple web application with a username and password. A file can be used to store the username and password for validated users for this activity. No additional Web application functionality is needed after successful login other than a Greeting of your choice and the ability to update the password in a form. 

b. Password update Form – This Python form allows a user to update a user’s password after they have successfully logged in. 

c. Authentication functions – These Python functions that will check the following NIST SP 800-63B criteria are met upon login or upon password update:   SHALL be at least 8 characters in length 

• SHOULD be no more than 64 characters in length 

• SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised (Provided as CommonPasswords.txt) 

• If the chosen secret is found in the list, the application SHALL advise the subscriber that they need to select a different secret, SHALL provide the reason for rejection, and SHALL require the subscriber to choose a different value 

• SHALL implement a time-based rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be made on the subscriber’s account. For this exercise throttling should start after 15 attempts. 

• When the subscriber successfully authenticates, the verifier SHOULD disregard any previous failed attempts for that user from the same IP address 

d. Logger – Create a log to log all failed login attempts. The Log should include date, time and IP address. 

e. Log Analyzer – Create a Python log analyzer application that reads the log file created in part d to identify and geo-locate all IP addresses where more than 10 failed attempts in a period of less than 5 minutes. The geolocation should include the Lat/Long value provide from the IP Address location. 

A sample report might look like this: 

100.16.4.23 had 12 failed login attempts in a 5 minute period on Jul 7, 2019. 

100.16.4.23 has a Lat/Long of 41.2908816/-73.610759. 

Hints:

1. Leverage the File I/O, Flask and Data structures work previously performed in the class. 

2. Use functions to enhance code reuse and modularity. 

3. Use the AWS Cloud9 IDE. 

4. Use Python Lists or other data structures to store the Common Passwords and then appropriate search functions to expedite comparisons. 

5. You can use “request.environ[‘REMOTE_ADDR’]” to obtain the client IP address. You will need to import the request package: “from flask import request”. 

6. You will need to load the ip2geotools Python module to perform the GeoLocation (sudo python3 -m pip install ip2geotools). You will need to import the IpCity Package (from 

ip2geotools.databases.noncommercial import DbIpCity). See the ip2geotools for additional method and objects available. 

password
123456
12345678
1234
qwerty
12345
dragon
baseball
football
letmein
monkey
abc123
mustang
michael
shadow
master
jennifer
111111
2000
jordan
superman
harley
1234567
hunter
trustno1
ranger
buster
thomas
robert
soccer
batman
test
pass
killer
hockey
george
charlie
andrew
michelle
love
sunshine
jessica
pepper
daniel
access
123456789
654321
joshua
maggie
starwars
silver
william
dallas
yankees
123123
ashley
666666
hello
amanda
orange
biteme
freedom
computer
sexy
thunder
nicole
ginger
heather
hammer
summer
corvette
taylor
austin
1111
merlin
matthew
121212
golfer
cheese
princess
martin
chelsea
patrick
richard
diamond
yellow
bigdog
secret
asdfgh
sparky
cowboy
camaro
anthony
matrix
falcon
iloveyou
bailey
guitar
jackson
purple
scooter
phoenix
aaaaaa
morgan
tigers
porsche
mickey
maverick
cookie
nascar
peanut
justin
131313
money
samantha
steelers
joseph
snoopy
boomer
whatever
iceman
smokey
gateway
dakota
cowboys
eagles
chicken
black
zxcvbn
please
andrea
ferrari
knight
hardcore
melissa
compaq
coffee
booboo
johnny
bulldog
xxxxxx
welcome
james
player
ncc1701
wizard
scooby
charles
junior
internet
mike
brandy
tennis
banana
monster
spider
lakers
miller
rabbit
enter
mercedes
brandon
steven
fender
john
yamaha
diablo
chris
boston
tiger
marine
chicago
rangers
gandalf
winter
barney
edward
raiders
badboy
spanky
bigdaddy
johnson
chester
london
midnight
blue
fishing
0
hannah
slayer
11111111
rachel
redsox
thx1138
asdf
marlboro
panther
zxcvbnm
arsenal
oliver
qazwsx
mother
victoria
7777777
jasper
angel
david
winner
crystal
golden
butthead
viking
jack
iwantu
shannon
murphy
angels
prince
cameron
girls
madison
wilson
carlos
willie
startrek
captain
maddog
jasmine
butter
booger
angela
golf
lauren
rocket
tiffany
theman
dennis
liverpoo
flower
forever
green
jackie
muffin
turtle
sophie
danielle
redskins
toyota
jason
sierra
winston
debbie
giants
packers
newyork
jeremy
casper
bubba
112233
sandra
lovers
mountain
united
cooper
driver
tucker
helpme
pookie
lucky
maxwell
8675309
bear
gators
5150
222222
jaguar
monica
fred
happy
hotdog
gemini
lover
xxxxxxxx
777777
canada
nathan
victor
florida
88888888
nicholas
rosebud
metallic
doctor
trouble
success
stupid
tomcat
warrior
peaches
apples
fish
qwertyui
magic
buddy
dolphins
rainbow
gunner
987654
freddy
alexis
braves
2112
1212
cocacola
xavier
dolphin
testing
bond007
member
calvin
voodoo
7777
samson
alex
apollo
fire
tester
walter
beavis
voyager
bonnie
rush2112
beer
apple
scorpio
jonathan
skippy
sydney
scott
red123
power
gordon
travis
beaver
star
jackass
flyers
232323
zzzzzz
steve
rebecca
scorpion
doggie
legend
ou812
yankee
blazer
bill
runner
birdie
555555
parker
topgun
asdfasdf
heaven
viper
animal
2222
bigboy
4444
arthur
baby
private
godzilla
donald
williams
lifehack
phantom
dave
rock
august
sammy
cool
brian
platinum
jake
bronco
paul
mark
frank
heka6w2
copper
billy
cumshot
garfield
willow
cunt
little
carter
albert
kitten
super
jordan23
eagle1
shelby
america
11111
jessie
house
free
123321
chevy
white
broncos
horney
surfer
nissan
999999
saturn
airborne
elephant
marvin
action
adidas
qwert
kevin
1313
explorer
walker
police
christin
december
benjamin
wolf
sweet
therock
king
online
brooklyn
teresa
cricket
sharon
dexter
racing
gregory
teens
redwings
dreams
michigan
hentai
magnum
87654321
nothing
donkey
trinity
digital
333333
stella
cartman
guinness
123abc
speedy
buffalo